These two files should help you to import passwords from mac OS X keychains to 1password.

Assumptions:

1) You have some experience with scripting/are a power-user. These scripts worked for me

but they haven't been extensively tested and if they don't work, you're on your own!

Please read this whole document before starting this process. If any of it seems

incomprehensible/frightening/over your head please do not use these scripts. You will

probably do something Very Bad and I wouldn't want that.

2) You have ruby 1.9.2 installed on your machine. This comes as standard with Lion, previous

versions of OS X may have earlier versions of ruby, which *may* work, but then again, they

may not :-) You can check by opening the terminal application and typing ruby -v.

NB. The script has now been modified to work with ruby 1.8.7 (which is actually standard with Lion.

3) *THIS IS IMPORTANT* None of your passwords, usernames or site names contains a comma. It's

highly unlikely that a site name will contain a comma, fairly unlikely that usernames will,

but eminently possible that your passwords might. If they do, this script *will not work*

as supplied. You can modify it to quote all the values (there's a function for this already

in the script) before it outputs them, but beware: if any of your passwords contains a "

character it will break if you do this. If you have both quotes and commas in your passwords,

well, damn, you're fresh out of luck. The best you can do is to find the passwords with commas

in and remove them manually from the exported keychain (I'll mention where to do this below)

Instructions:

0) Save keychain.rb and click_allow.scpt in your home directory.

1) Enable full GUI scripting by going to the Universal Access System Preference Pane

and checking "Enable access for assistive devices"

2) Open the Terminal application and run the following command:

security dump-keychain -d login.keychain > keychain.txt

(If you have multiple keychains you should repeat this whole process once from step 2 onwards for

each one. You will have to change 'login.keychain' to 'foo.keychain' or somesuch.)

3) When you run the above command, the system will ask for permission to use your keychain. If you

have a separate keychain password/have paranoid settings on your keychain, you may need to enter

a password now. Otherwise, you will be presented with a dialog box asking you whether you want to

allow permission to access the first item in your keychain. You will be asked this once for every

item in your keychain (zzz). This is where the other file comes in:

4) Find the click_allow.scpt in your home directory using Finder, double click it. It will open in

the AppleScript editor. Click the run button. If all is well, the script will click the "Allow"

button for you lots of times until all of your keychain entries have been exported. Shouldn't

take more than a few minutes even for hundreds of entries.

5) When that finishes, go back to the Terminal window and run the following command:

ruby keychain.rb keychain.txt | sort > keychain.csv

6) If all is well, that command will finish very quickly without any message. If it spouts an error

at you, sorry, you'll have to fix the script, something's broken. Otherwise you should try opening

up keychain.csv in your favourite text editor (TextEdit? <shiver>) to make sure it contains a list

of keychain entries. Now is the time to search for passwords containing a comma (you may need regular

expressions to do this if you have a lot of keychain entries, since it's a comma-separated file)

and delete them to stop them hosing the 1password import. You'll have to enter these manually, hopefully

it isn't too many.

7) Fire up 1password and choose File>Import. You want to import keychain.csv as a "CSV or Delimited Text"

file. The process is fairly self-explanatory, make sure you select "comma" as the delimiter at the

appropriate point. You will have to tell it which columns correspond to which fields (this is pretty

obvious) and you should check that there are exactly five columns. If you're seeing more than five

columns, one of your values contains a rogue comma and you need to fix it manually before you import the

file or it won't work. The 5th column is optional - it's the last modified date for the keychain entry;

unfortunately 1password won't let you import this as the "modified date" for the password but I put

it in a notes field just in case since I often find it helpful to know when a password was set.

8) IMPORTANT: You now have 2 files on your hard disk that contain unencrypted passwords. You need to delete

these securely if you are concerned about the possibility that someone might get your passwords. You have

two options. The easy option is to use Finder to move them to Trash, and then Secure Empty Trash. If you

are one of these funny people who likes to use their Trash Can as a temporary storage location and don't

want to empty it, you can go back to the terminal and issue rm keychain.csv keychain.txt, and then fire up Disk

Utility and use the "Erase Free Space" command on the relevant hard disk to securely blank all the free

space on your drive (this may take some time). NB: If you have an SSD drive in your computer there will be

no Secure Empty Trash (only plain Empty Trash) and there will be no "Erase Free Space" in Disk Utility.

This is because some SSDs delete things much more permanently than traditional hard disks by default, so

these commands are redundant. Simply emptying the trash/rm-ing the file from the terminal will suffice in

this case.

Acknowledgements: The original ruby script was written by Morgan Schweers of https://github.com/cyberfox. I've merely fixed bits that didn't work for me, and added the script to push the Allow button + this documentation.

This comment has been minimized.

Hmm, strange I must have got myself confused with RVM versions then. Looking again I see that you're right about 1.8.7. It would be nice if Apple occasionally shipped remotely recent versions of software with their OS, but hey ho. Thanks for fixing.

Hmm, strange I must have got myself confused with RVM versions then. Looking again I see that you're right about 1.8.7. It would be nice if Apple occasionally shipped remotely recent versions of software with their OS, but hey ho. Thanks for fixing.

This comment has been minimized.

this is awesome. at first i did not trust this, but when i applied this with little brave, i saw that this works like real awesome. i love this and love the coder of this. thanks sooooooooooooooo much.....

this is awesome. at first i did not trust this, but when i applied this with little brave, i saw that this works like real awesome. i love this and love the coder of this. thanks sooooooooooooooo much.....

This comment has been minimized.

No need to remove commas from passwords. Tabs work great as delimiters, and I've yet to see an URL, user name or password with a tab character in it. The fix is simple: In the script keychain.rb, in the line beginning with "puts", replace every comma (",") with "\t" (without the quotes). 1Password recognizes and imports tab-CSVs just fine, despite the "C" in CSV.

No need to remove commas from passwords. Tabs work great as delimiters, and I've yet to see an URL, user name or password with a tab character in it. The fix is simple: In the script keychain.rb, in the line beginning with "puts", replace every comma (",") with "\t" (without the quotes). 1Password recognizes and imports tab-CSVs just fine, despite the "C" in CSV.

This comment has been minimized.

In your notes you suggest rm keychain.csv keychain.txt then Erase Free Space. You can avoid the latter with the command srm keychain.csv keychain.txt -- srm is a variant of the rm command which erases the contents of the file rather than simply unlinking it. See man srm for details.

In your notes you suggest rm keychain.csv keychain.txt then Erase Free Space. You can avoid the latter with the command srm keychain.csv keychain.txt -- srm is a variant of the rm command which erases the contents of the file rather than simply unlinking it. See man srm for details.

This comment has been minimized.

I was struggeling with commas in my passwords. To get rid of these I imported the csv file into Libre Office and checked where the timestamps did not align correctly - that was much easier for me than using regex ;)

I was struggeling with commas in my passwords. To get rid of these I imported the csv file into Libre Office and checked where the timestamps did not align correctly - that was much easier for me than using regex ;)

This comment has been minimized.

hi, everything worked great up to the point where I was to use the ruby script, the generated csv was empty (same as techerausa). I'm on osx mavericks which has ruby version 2.0.0p451, any idea how to get around this?

hi, everything worked great up to the point where I was to use the ruby script, the generated csv was empty (same as techerausa). I'm on osx mavericks which has ruby version 2.0.0p451, any idea how to get around this?

This comment has been minimized.

@amilor, @techerausa it did came blank for me too. Turns out I store general passwords not associated with websites or things like that so the script ignores them. To fix it a new block must be added on the process_entry method. It should look like follows:

@amilor, @techerausa it did came blank for me too. Turns out I store general passwords not associated with websites or things like that so the script ignores them. To fix it a new block must be added on the process_entry method. It should look like follows:

This comment has been minimized.

click_allow.scpt did not work for me on OSX Yosemite, claiming System Events got an error: Can’t get group 1 of window 1 of process "SecurityAgent". Invalid index. After some playing around, I got the following hack:

click_allow.scpt did not work for me on OSX Yosemite, claiming System Events got an error: Can’t get group 1 of window 1 of process "SecurityAgent". Invalid index. After some playing around, I got the following hack:

This comment has been minimized.

awesome !@rwest I found a bug that it will not record the last data by running the ruby script . Because the last line of keychain.txt is not like /^keychain: / , so accum is not empty . the last assume cannot be running by the method process_entry .

You can insert process_entry(accum) after the last line of keychain.rb .

awesome !@rwest I found a bug that it will not record the last data by running the ruby script . Because the last line of keychain.txt is not like /^keychain: / , so accum is not empty . the last assume cannot be running by the method process_entry .

You can insert process_entry(accum) after the last line of keychain.rb .

This comment has been minimized.

This is weird... If the card had a pencil icon in Apple Keychain Access, it does not get into the CSV. It doesn't matter if it says "application password" or "Internet password" or the format of the URL field.

Apple doesn't let you change which kind of entry it is. When you created the entry originally you either put a URL or a Name in there and apple picked the type of entry to make it even though they seem completely the same. What was the point? No idea.

But why does the script ignore the entries that were originally not made with URLs? I need to manually go through all those entries now and copy the data out... easier than figuring out what is wrong in the script. Maybe someone else would like to try.

This is weird... If the card had a pencil icon in Apple Keychain Access, it does not get into the CSV. It doesn't matter if it says "application password" or "Internet password" or the format of the URL field.

Apple doesn't let you change which kind of entry it is. When you created the entry originally you either put a URL or a Name in there and apple picked the type of entry to make it even though they seem completely the same. What was the point? No idea.

But why does the script ignore the entries that were originally not made with URLs? I need to manually go through all those entries now and copy the data out... easier than figuring out what is wrong in the script. Maybe someone else would like to try.

Edited 1 time

Apr 29, 2016

This comment has been minimized.

@roquie - Am working with your update, thanks, but also am N00b in Applescript - have three keychains Login (98), iCloud (260), System (52) and running El Capitan 10.11.5. The Login dump is working fine but when I change to iCloud and System it dumps blank.

I'm possibly getting confused in what to execute in the original eight steps. Can someone please confirm and/or update them to work with El Capitan if not already, and ability to also export iCloud or any other keychain to both 1Password and also CSV. I also couldn't find /system preferences/security & privacy/privacy "Enable access for assistive devices either, but maybe that's part of the issue, and then I couldn't get the System Events script to work either - possibly related.

And finally, I can't change password to blank without risking losing the keychain either as my OSX user login is sync'd with Apple ID, but at worst I'm still happy to click 'Allow' 400 times - surely it's better than default Apple method of typing credentials.

@roquie - Am working with your update, thanks, but also am N00b in Applescript - have three keychains Login (98), iCloud (260), System (52) and running El Capitan 10.11.5. The Login dump is working fine but when I change to iCloud and System it dumps blank.

I'm possibly getting confused in what to execute in the original eight steps. Can someone please confirm and/or update them to work with El Capitan if not already, and ability to also export iCloud or any other keychain to both 1Password and also CSV. I also couldn't find /system preferences/security & privacy/privacy "Enable access for assistive devices either, but maybe that's part of the issue, and then I couldn't get the System Events script to work either - possibly related.

And finally, I can't change password to blank without risking losing the keychain either as my OSX user login is sync'd with Apple ID, but at worst I'm still happy to click 'Allow' 400 times - surely it's better than default Apple method of typing credentials.

Appreciate some help please.

This comment has been minimized.

Thanks for this project!
I had to make one small mod to the Apple Script to get this beast to run on my computer (running MacOS 10.12.1).Change: removed "of group 1" from the Apple Script.
Also, working in MS Excel, I was able to quickly find any passwords containing commas by looking for rows that did not contain a time stamp in column E.

Edited 1 time

Nov 11, 2016

Thanks for this project!
I had to make one small mod to the Apple Script to get this beast to run on my computer (running MacOS 10.12.1).Change: removed "of group 1" from the Apple Script.
Also, working in MS Excel, I was able to quickly find any passwords containing commas by looking for rows that did not contain a time stamp in column E.

This comment has been minimized.

Having the same problem as David above, iCloud.keychain (where all the useful stuff is) dumps an empty file.

Also, the login.keychain creates a massive file for me (good), but when I run the ruby script, it only gives me a csv with one entry line (correctly formatted login and password for something, but it's the very last one in my keychain, nothing before it gets processed. Odd, because I would expect it to get to a certain one and then break, but to skip all of them and only process the final one? Seems odd... Any alternatives known for this?

btw, it has an @ symbol instead of a pencil ... symbol as the "type" so maybe that's why it worked? Landry314 mentioned this above as well...

Having the same problem as David above, iCloud.keychain (where all the useful stuff is) dumps an empty file.

Also, the login.keychain creates a massive file for me (good), but when I run the ruby script, it only gives me a csv with one entry line (correctly formatted login and password for something, but it's the very last one in my keychain, nothing before it gets processed. Odd, because I would expect it to get to a certain one and then break, but to skip all of them and only process the final one? Seems odd... Any alternatives known for this?

btw, it has an @ symbol instead of a pencil ... symbol as the "type" so maybe that's why it worked? Landry314 mentioned this above as well...